PT-2024-30179 · Langflow · Langflow

0Gur1O · Published 2024-10-31 · Updated 2025-05-27 · CVE-2024-42835

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions langflow version 1.0.12

Description The issue is related to a remote code execution (RCE) vulnerability in the PythonCodeTool component. This vulnerability allows for the execution of arbitrary code on the target system by leveraging the use of exec() in the PythonCodeTool component. A malicious JSON file can be imported to exploit this issue.

Recommendations For langflow version 1.0.12, as a temporary workaround, consider disabling the PythonCodeTool component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-42835

GHSA-56M6-4MHW-H3G5

PYSEC-2024-279

Affected Products

Langflow

References · 12

• https://github.com/langflow-ai/langflow/issues/2908 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42835 · Security Note
• https://osv.dev/vulnerability/GHSA-56m6-4mhw-h3g5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-279 · Vendor Advisory
• https://github.com/langflow-ai/langflow · Note
• https://t.me/cvedetector/9506 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1852032240093413714 · Twitter Post
• https://twitter.com/Checkmarx/status/1853503129377202549 · Twitter Post
• https://twitter.com/CVEnew/status/1851985325553238181 · Twitter Post
• https://twitter.com/oktsec/status/1851997012855583009 · Twitter Post
• https://t.me/cvenotify/123752 · Telegram Post